Detection for Putter Panda, we got this.
Summary: Cisco Talos responded to a CrowdStrike post that attributed an attack to a group identified as PLA Unit 61486, and confirmed its Sourcefire IPS/Snort rules have covered the malware and tools named in that post since 2012. Detection comes through rules 21240 and 21241 for outbound traffic, plus sid 21242 for a similar variant.
What's compelling: The adversary in this case is named as a state military unit, and the detection cited rests on rules that have been in place since 2012 - a security leader should ask whether coverage that old still matches what this actor is running today.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026